Quote from: JorgeStolfi on July 27, 2014, 11:07:39 PM

Even if your Trezor works as it is supposed to, you will still be vulnerable to attacks like address phishing (the hacker tricks you into sending payment to the wrong address) and man-in-the-middle (a compromised PC software displays the correct destination address on the screen, but puts the thief's address in the transaction that it gives Trezor to sign. While an alert user can notice the substitution by checking the Trezor's display, there will inevitably be users who check only the PC screen, out of laziness or because they are not aware of the risk.)

That's true. It is one of our main goals to educate our users on the few risks left after they purchase a Trezor:

store your recovery seed in a safe place, prevent it's misusage
don't forget your encryption passphrase if you are using this advanced option
use a different channel to verify the payment address received through internet (phone, in person...)

Visual (dsiplay) and physical verification (button press) is one of the key security properties of Trezor. If someone is not using it for his advantage, he doesn't understand the threats. Again, education is important.

Quote from: JorgeStolfi on July 27, 2014, 11:07:39 PM

If you use your Trezor anywhere outside your home, whatever you do to unlock it (passwords, PIN, voiceprints, secret handshakes...) can be recorded and used by someone who later steals the device.

PIN - can't be logged, please search for the Trezor PIN matrix.
passphrase - best practice when you need to use a public computer, just have a small spending amount without a passphrase

Quote from: JorgeStolfi on July 27, 2014, 11:07:39 PM

It may have a bug (like the classical buffer overrun)...
that is discovered by a hacker and can be exploited by a malicious software in the PC to extract the private keys.

security researchers that tested Trezor were a bit disappointed that they couldnt trick Trezor with buffer overflow

Quote from: JorgeStolfi on July 27, 2014, 11:07:39 PM

Perhaps the designers left a secret backdoor

it's opensource, everybody can check and believe me they are doing that..

Quote from: JorgeStolfi on July 27, 2014, 11:07:39 PM

If Trezor uses custom chips, perhaps someone switched the tapes on the way to the foundry, or substituted the chips on the way back.

Our manufacturer is sourcing standard material with their long-time partners audited on a regular basis AND without them ever knowing the final product.

Quote from: JorgeStolfi on July 27, 2014, 11:07:39 PM

Perhaps someone replaced your Trezor by a compromised one, in transport or anytime after you got it. (Ask any magician how it can be done under your nose.)

That might be risky BUT if you are not completely naive, you 1. check the integrity of the package before you use the device, 2. only buy it from official/trusted shops 3. the casing cannot be opened without damaging it so replacing internals won't be easy
if you do the above and still not sure, contact our support, we might have some ways to determine further (no, no privacy breach will be done)

Quote from: JorgeStolfi on July 27, 2014, 11:07:39 PM

It seems very difficult to check whether your device is legitimate and unmodified, and that the software that it is running is the same that is posted on github.

http://satoshilabs.com/news/2014-06-22-wanted-independent-trezor-code-reviewers/